Looks like you've handled things well, that is a very small amount stolen.

Would be interesting to know how they got in, was it a cross site scripting vulnerability?

This hack is a good example of why we need more clients for Steem, preferably open source. Steemit.com being the only usable portal into Steem is hampering the decentralization aspect. Is there someone working on alternative clients?